Dannik
Verified User
Hi,
Most of my servers are setup with many default options, but this week a certificate problem was brought to my attention. 1 of my customers wants to pull mails using imap_open(). This works, but only with unencrypted connections:
I found this very strange, so I tried myself at work, using a Windows server with IIS. All worked fine, I could connect and fetch mail without any problems and the right certificate was presented.
However, when running from some other servers (running FreeBSD and AlmaLinux) I experienced something else: the returned certificate was the one from the DA server, not from the originally requested domain. Tests show this also occurs with other domains on both my DA servers.
All tested domains use Let's Encrypt certificates and different SSL-checkers show everything is fine.
Can anyone help me with this problem?
I tested thing using the script below.
Regards,
Danny
Most of my servers are setup with many default options, but this week a certificate problem was brought to my attention. 1 of my customers wants to pull mails using imap_open(). This works, but only with unencrypted connections:
PHP:
$hostname = '{mail.usersdomain.nl:143/notls}'; // functioning ok, but with security errors
$hostname = '{mail.usersdomain.nl:993/imap/ssl}'; // failing on the certificate most times; the server's certificate is returnedI found this very strange, so I tried myself at work, using a Windows server with IIS. All worked fine, I could connect and fetch mail without any problems and the right certificate was presented.
However, when running from some other servers (running FreeBSD and AlmaLinux) I experienced something else: the returned certificate was the one from the DA server, not from the originally requested domain. Tests show this also occurs with other domains on both my DA servers.
All tested domains use Let's Encrypt certificates and different SSL-checkers show everything is fine.
Can anyone help me with this problem?
I tested thing using the script below.
Regards,
Danny
PHP:
<?php
// $host = 'mail.usersdomain.nl'; This doesn't work, so we have to use a workaround
// Workaround
$domain = 'mail.usersdomain.nl';
$ip = gethostbyname($domain);
$host = gethostbyaddr($ip); $port = 993;
// Next step
$mailbox = "{{$host}:{$port}/imap/ssl}INBOX";
$user = "[email protected]";
$pass = "TheRightPassword";
echo "<pre>";
// PHP / IMAP info
echo "PHP version: " . phpversion() . "\n";
if (function_exists('imap_open')) {
echo "IMAP extension: enabled\n";
} else {
echo "IMAP extension: NOT enabled\n";
exit;
}
// Test connection
echo "Trying imap_open() on $mailbox ...\n";
$mbox = @imap_open($mailbox, $user, $pass);
if ($mbox) {
echo "✅ Connection successful!\n";
imap_close($mbox);
} else {
echo "❌ Connection failed.\n";
echo "Errors:\n";
print_r(imap_errors());
echo "Alerts:\n";
print_r(imap_alerts());
}
// Extra openssl check
echo "\nOpenSSL version: " . OPENSSL_VERSION_TEXT . "\n";
echo "Stream context test:\n";
$context = stream_context_create([
'ssl' => [
'capture_peer_cert' => true,
'capture_peer_cert_chain' => true,
'verify_peer' => true,
'verify_peer_name' => true,
'allow_self_signed' => false,
]
]);
$client = @stream_socket_client("ssl://{$host}:{$port}", $errno, $errstr, 10, STREAM_CLIENT_CONNECT, $context);
if ($client) {
$params = stream_context_get_params($client);
$cert = $params['options']['ssl']['peer_certificate'];
$certInfo = openssl_x509_parse($cert);
echo "Server CN: " . $certInfo['subject']['CN'] . "\n";
echo "Valid until: " . date('Y-m-d H:i:s', $certInfo['validTo_time_t']) . "\n";
} else {
echo "Failed to fetch cert: $errstr ($errno)\n";
}
echo "</pre>";
[CODE]
Connection failed.
